CVE-2026-98303

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98303", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.338Z", "datePublished": "2026-10-06T08:46:00.524Z", "dateUpdated": "2026-10-19T09:17:14.136Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:17:14.136Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup\n\nWhen the forward output route cannot be used in icmp_route_lookup(),\nit enters the \"reverse path\" and calls ip_route_input() on fl4_dec.daddr,\nthe original packet's source address.\n\nip_route_input() only returns an error for truly invalid packets. For\nunreachable addresses it will succeed and return an input route whose\ndst.output is set to ip_rt_bug(). The existing check only rejects\nRTN_LOCAL routes, so the RTN_UNREACHABLE route types can still be returned\nand later used for output, syzkaller triggering a WARN_ON_ONCE()\nin ip_rt_bug() as bellow:\n\n ------------[ cut here ]------------\n WARNING: net/ipv4/route.c:1273 at ip_rt_bug+0x14/0x20\n RIP: 0010:ip_rt_bug+0x14/0x20\n Call Trace:\n ip_push_pending_frames+0xfa/0x100\n __icmp_send+0x905/0xf10\n ip_options_compile+0xc0/0xd0\n ip_rcv_finish_core+0x321/0xae0\n ip_rcv+0x1de/0x260\n __netif_receive_skb_one_core+0x11a/0x130\n netif_receive_skb+0x7b/0x260\n tun_get_user+0x11bf/0x1c10\n ------------[ cut here ]------------\n\nReject input route that is RTN_UNREACHABLE to fix it. The net warning\nis only printed for RTN_LOCAL, as RTN_UNREACHABLE is not the result of\na race condition."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/icmp.c"], "versions": [{"version": "8b7817f3a959ed99d7443afc12f78a7e1fcc2063", "lessThan": "06083cea4a3b95f5ebc85312f97d7086e6c9e782", "status": "affected", "versionType": "git"}, {"version": "8b7817f3a959ed99d7443afc12f78a7e1fcc2063", "lessThan": "83aa83f81a8fec30ff5372dee60b2f0561bcb2ca", "status": "affected", "versionType": "git"}, {"version": "8b7817f3a959ed99d7443afc12f78a7e1fcc2063", "lessThan": "cac69c50716c712ef0114837c9427da66066124c", "status": "affected", "versionType": "git"}, {"version": "8b7817f3a959ed99d7443afc12f78a7e1fcc2063", "lessThan": "1af2d87964d87ba7626d96928d68c09158b5a223", "status": "affected", "versionType": "git"}, {"version": "8b7817f3a959ed99d7443afc12f78a7e1fcc2063", "lessThan": "fda3000147dc96c75ba162f680bec0a9fecf3037", "status": "affected", "versionType": "git"}, {"version": "8b7817f3a959ed99d7443afc12f78a7e1fcc2063", "lessThan": "2998147b59c9df0a51477c7a6b3d1f0ba3127dd4", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/icmp.c"], "versions": [{"version": "2.6.25", "status": "affected"}, {"version": "0", "lessThan": "2.6.25", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.18.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/06083cea4a3b95f5ebc85312f97d7086e6c9e782"}, {"url": "https://git.kernel.org/stable/c/83aa83f81a8fec30ff5372dee60b2f0561bcb2ca"}, {"url": "https://git.kernel.org/stable/c/cac69c50716c712ef0114837c9427da66066124c"}, {"url": "https://git.kernel.org/stable/c/1af2d87964d87ba7626d96928d68c09158b5a223"}, {"url": "https://git.kernel.org/stable/c/fda3000147dc96c75ba162f680bec0a9fecf3037"}, {"url": "https://git.kernel.org/stable/c/2998147b59c9df0a51477c7a6b3d1f0ba3127dd4"}], "title": "ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ipv4/icmp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "06083cea4a3b95f5ebc85312f97d7086e6c9e782", "status": "affected", "version": "8b7817f3a959ed99d7443afc12f78a7e1fcc2063", "versionType": "git"}, {"lessThan": "83aa83f81a8fec30ff5372dee60b2f0561bcb2ca", "status": "affected", "version": "8b7817f3a959ed99d7443afc12f78a7e1fcc2063", "versionType": "git"}, {"lessThan": "cac69c50716c712ef0114837c9427da66066124c", "status": "affected", "version": "8b7817f3a959ed99d7443afc12f78a7e1fcc2063", "versionType": "git"}, {"lessThan": "1af2d87964d87ba7626d96928d68c09158b5a223", "status": "affected", "version": "8b7817f3a959ed99d7443afc12f78a7e1fcc2063", "versionType": "git"}, {"lessThan": "fda3000147dc96c75ba162f680bec0a9fecf3037", "status": "affected", "version": "8b7817f3a959ed99d7443afc12f78a7e1fcc2063", "versionType": "git"}, {"lessThan": "2998147b59c9df0a51477c7a6b3d1f0ba3127dd4", "status": "affected", "version": "8b7817f3a959ed99d7443afc12f78a7e1fcc2063", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ipv4/icmp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.25"}, {"lessThan": "2.6.25", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.54", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup\n\nWhen the forward output route cannot be used in icmp_route_lookup(),\nit enters the \"reverse path\" and calls ip_route_input() on fl4_dec.daddr,\nthe original packet's source address.\n\nip_route_input() only returns an error for truly invalid packets. For\nunreachable addresses it will succeed and return an input route whose\ndst.output is set to ip_rt_bug(). The existing check only rejects\nRTN_LOCAL routes, so the RTN_UNREACHABLE route types can still be returned\nand later used for output, syzkaller triggering a WARN_ON_ONCE()\nin ip_rt_bug() as bellow:\n\n ------------[ cut here ]------------\n WARNING: net/ipv4/route.c:1273 at ip_rt_bug+0x14/0x20\n RIP: 0010:ip_rt_bug+0x14/0x20\n Call Trace:\n ip_push_pending_frames+0xfa/0x100\n __icmp_send+0x905/0xf10\n ip_options_compile+0xc0/0xd0\n ip_rcv_finish_core+0x321/0xae0\n ip_rcv+0x1de/0x260\n __netif_receive_skb_one_core+0x11a/0x130\n netif_receive_skb+0x7b/0x260\n tun_get_user+0x11bf/0x1c10\n ------------[ cut here ]------------\n\nReject input route that is RTN_UNREACHABLE to fix it. The net warning\nis only printed for RTN_LOCAL, as RTN_UNREACHABLE is not the result of\na race condition."}], "id": "CVE-2026-98303", "lastModified": "2026-10-19T10:18:32.300", "metrics": {}, "published": "2026-10-06T09:18:21.370", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/06083cea4a3b95f5ebc85312f97d7086e6c9e782"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1af2d87964d87ba7626d96928d68c09158b5a223"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2998147b59c9df0a51477c7a6b3d1f0ba3127dd4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/83aa83f81a8fec30ff5372dee60b2f0561bcb2ca"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cac69c50716c712ef0114837c9427da66066124c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fda3000147dc96c75ba162f680bec0a9fecf3037"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup", "id": "2546531", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546531"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-617", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup\nWhen the forward output route cannot be used in icmp_route_lookup(),\nit enters the \"reverse path\" and calls ip_route_input() on fl4_dec.daddr,\nthe original packet's source address.\nip_route_input() only returns an error for truly invalid packets. For\nunreachable addresses it will succeed and return an input route whose\ndst.output is set to ip_rt_bug(). The existing check only rejects\nRTN_LOCAL routes, so the RTN_UNREACHABLE route types can still be returned\nand later used for output, syzkaller triggering a WARN_ON_ONCE()\nin ip_rt_bug() as bellow:\n------------[ cut here ]------------\nWARNING: net/ipv4/route.c:1273 at ip_rt_bug+0x14/0x20\nRIP: 0010:ip_rt_bug+0x14/0x20\nCall Trace:\nip_push_pending_frames+0xfa/0x100\n__icmp_send+0x905/0xf10\nip_options_compile+0xc0/0xd0\nip_rcv_finish_core+0x321/0xae0\nip_rcv+0x1de/0x260\n__netif_receive_skb_one_core+0x11a/0x130\nnetif_receive_skb+0x7b/0x260\ntun_get_user+0x11bf/0x1c10\n------------[ cut here ]------------\nReject input route that is RTN_UNREACHABLE to fix it. The net warning\nis only printed for RTN_LOCAL, as RTN_UNREACHABLE is not the result of\na race condition.", "A flaw was found in the Linux kernel's IPv4 networking subsystem. When looking up routes to send Internet Control Message Protocol (ICMP) error messages, the kernel fails to properly reject unreachable input routes. A remote attacker can exploit this flaw by transmitting network packets that trigger ICMP responses to unreachable destinations, causing the system to invoke an invalid route handler and trigger a kernel warning, potentially leading to a Denial of Service (DoS)."], "name": "CVE-2026-98303", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98303\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98303\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98303.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8b7817f3a959ed99d7443afc12f78a7e1fcc2063,06083cea4a3b95f5ebc85312f97d7086e6c9e782)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8b7817f3a959ed99d7443afc12f78a7e1fcc2063,83aa83f81a8fec30ff5372dee60b2f0561bcb2ca)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8b7817f3a959ed99d7443afc12f78a7e1fcc2063,cac69c50716c712ef0114837c9427da66066124c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8b7817f3a959ed99d7443afc12f78a7e1fcc2063,1af2d87964d87ba7626d96928d68c09158b5a223)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8b7817f3a959ed99d7443afc12f78a7e1fcc2063,fda3000147dc96c75ba162f680bec0a9fecf3037)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8b7817f3a959ed99d7443afc12f78a7e1fcc2063,2998147b59c9df0a51477c7a6b3d1f0ba3127dd4)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.25"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.25)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.54,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.8,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc4,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-06T14:00:20.949988+00:00", "updated": "2026-10-09T17:00:09.855685+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}